Proxy events
Configure the access events of Artica Proxy, understand which requests are logged, and send them to Wazuh, syslog, Splunk or the Artica SIEM.
Each request that passes through Artica Proxy produces an access event:
who made the request, which website was requested, what the proxy answered, how long it took and how many bytes were sent.
These events feed the statistics of Artica, and you can send them to your own tools: a syslog server, a log management service or a SIEM such as Wazuh.
This section explains where the events are configured, which requests are logged, and how to send them outside of Artica.
Where to configure the events
- On the left menu, select
Your proxy>Global settings. - Stay on the General settings tab and scroll down to the Events section.
Click on a row to change its settings. The main rows are:
- Minimal statistics: the local statistics computed by Artica from the events.
- Remote Syslog server: send the events to a remote syslog server.
- Wazuh: write the events as JSON for the Wazuh agent. See Send proxy requests to Wazuh.
- Access events: the local access log (
/var/log/squid/access.log). You can remove the local events if you send them to another server. - Include HTTP User-Agents in real-time events: add the User-Agent of the client to the events.
- Log requests to internal networks: also log the requests to private networks (see below).
Which requests are logged
- Requests to internal networks are not logged by default. The requests to
10.0.0.0/8,172.16.0.0/12and192.168.0.0/16are excluded, because they are usually local traffic. To log them, turn ON Log requests to internal networks. - Requests sent from the proxy itself are not logged. Requests coming from
127.0.0.1are internal to Artica. When you test a feature, browse from a client workstation, not from the proxy. - These exclusions are applied by the proxy before the events are written: the outputs fed by the proxy (access log, statistics, Wazuh, SIEM) do not receive these requests either.
Send the events outside of Artica
| Destination | When to use it | Page |
|---|---|---|
| Wazuh | You use Wazuh as your SIEM and want alerts on denied requests, authentication failures or server errors. | Send proxy requests to Wazuh |
| Synology Log Center | You want to store the requests on a Synology NAS, for legal retention. | Use Synology to store Artica Proxy web requests |
| Several syslog servers | You must send the requests to more than one syslog server. | Send proxy events to multiple syslog servers |
| Splunk | You use Splunk to analyze your logs. | Send events to Splunk server |
| Artica SIEM | You want proxy analytics and dashboards across several proxies. | Connect Artica Proxy to the Artica SIEM |
Understand the events
Some statuses shown in the real-time requests are surprising. For example, Not Cached - No Content (HTTP 204) is a normal answer: the remote server processed the request and deliberately sent an empty reply. See Not Cached - No Content.